@voxgig/sdkgen 4.10.0 → 4.11.0

package/project/.sdk/tm/csharp/feature/SecretsFeature.cs

@@ -321,11 +321,19 @@ public class SecretsFeature : BaseFeature
     // ---------------------------------------------------------------
     // Resolution.
 
-    // One resolution, shared by every concurrent caller. A settled SUCCESS
-    // is kept only when caching is on (`cache: false` means every resolve
+    // One resolution, shared by every concurrent caller. A settled HIT is
+    // kept only when caching is on (`cache: false` means every resolve
     // asks the chain again); a FAILURE is always cleared, so a transient
     // vault outage never poisons the client permanently - the next
     // operation asks the chain again.
+    //
+    // A MISS is cleared too, however caching is set. That rule is
+    // sekreto's, not this feature's: `A miss is never cached: the next read
+    // asks again`, in sekreto's own source. Keeping a settled miss here
+    // would override that from the layer above, and a secret provisioned
+    // after startup - a mounted file, a policy granted a minute late -
+    // would never be picked up for the life of the client. `cache` is about
+    // caching a HIT; it was never a promise to keep saying no.
     private void Resolve()
     {
         if (null != _initerr)
@@ -361,9 +369,10 @@ public class SecretsFeature : BaseFeature
         }
 
         Exception? err = null;
+        var hit = false;
         try
         {
-            ResolveOnce();
+            hit = ResolveOnce();
         }
         catch (Exception ex)
         {
@@ -373,7 +382,7 @@ public class SecretsFeature : BaseFeature
         lock (_mu)
         {
             call.Err = err;
-            if (null != err || !_cache)
+            if (null != err || !_cache || !hit)
             {
                 _resolving = null;
             }
@@ -386,11 +395,14 @@ public class SecretsFeature : BaseFeature
         }
     }
 
-    private void ResolveOnce()
+    // Resolve once, reporting whether a credential came out of it. That
+    // bool is the whole of what Resolve() needs to tell a cacheable HIT
+    // from a miss it must not keep.
+    private bool ResolveOnce()
     {
         if (null == _sek)
         {
-            return;
+            return false;
         }
 
         // TryGet returns null on a MISS and THROWS on a provider error -
@@ -410,7 +422,7 @@ public class SecretsFeature : BaseFeature
                 // HITS while one is set and this branch is unreachable.)
                 _cred = found ?? "";
             }
-            return;
+            return null != found;
         }
 
         // Exchanging: what the chain resolved is the REFRESH token, kept
@@ -441,10 +453,24 @@ public class SecretsFeature : BaseFeature
             // stale the API answers with an expiry status and the transport
             // wrapper buys another, which is the same path expiry takes
             // anyway.
-            return;
+            return true;
+        }
+
+        // `auth: null` is the documented way to send NO credential, and a
+        // purchase is a credential-bearing call: the refresh token goes to
+        // the token endpoint in the request body. WithRefresh honours
+        // suppression for the RETRY, but it runs after this - by then the
+        // refresh token has already left the process, and no later check
+        // can call it back. The suppression has to be honoured here, before
+        // the first purchase, or it only ever half-held.
+        if (AuthSuppressed())
+        {
+            return false;
         }
 
         Buy();
+
+        return true;
     }
 
     // ---------------------------------------------------------------

package/project/.sdk/tm/csharp/test/feature/secrets/SecretsFeatureTest.cs

@@ -652,6 +652,82 @@ public class SecretsFeatureTest
             "out; the wire saw " + last.Auth);
     }
 
+    // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+    // feature used to override from the layer above.
+    //
+    // DEFAULT caching here, which is the whole point: `cache: true` is
+    // about holding a HIT, and keeping the settled resolution after a miss
+    // meant the chain was never asked again for the life of the client. A
+    // secret provisioned after startup (a mounted file, a vault policy
+    // granted a minute late) was invisible forever, and the only workaround
+    // was giving up hit caching entirely.
+    [Fact]
+    public void CachedMissIsReasked()
+    {
+        var present = false;
+        var calls = 0;
+        var late = new ProbeProvider
+        {
+            Fn = _ =>
+            {
+                calls++;
+                return present ? "LATEKEY01" : null;
+            },
+        };
+
+        var w = new Wire();
+        var client = SecretsClient(w, new Dictionary<string, object?>
+        {
+            ["feature"] = ProviderOpts(late, null),
+        });
+
+        DriveEntityOp(client, w);
+        var first = w.Api()[0];
+        Assert.True(!first.HasAuth || "" == first.Auth,
+            "the chain has nothing yet, so no credential should go out");
+
+        var asked = calls;
+        Assert.True(0 < asked);
+
+        // The secret is provisioned while the client is live.
+        present = true;
+
+        DriveEntityOp(client, w);
+        CredentialIs(w.Api()[w.Api().Count - 1].Auth, "LATEKEY01");
+
+        Assert.True(asked < calls,
+            "the MISS was cached: a secret that appears later can never be picked up");
+    }
+
+    // The other half of the same rule: a HIT is still cached by default, so
+    // the fix above must not turn every request into a chain walk.
+    [Fact]
+    public void CachedHitIsKept()
+    {
+        var calls = 0;
+        var counting = new ProbeProvider
+        {
+            Fn = _ =>
+            {
+                calls++;
+                return "STABLEKEY01";
+            },
+        };
+
+        var w = new Wire();
+        var client = SecretsClient(w, new Dictionary<string, object?>
+        {
+            ["feature"] = ProviderOpts(counting, null),
+        });
+
+        DriveEntityOp(client, w);
+        DriveEntityOp(client, w);
+
+        Assert.True(1 == calls,
+            "a hit must be cached under the default cache: true, chain asked " +
+            calls + " times");
+    }
+
     [Fact]
     public void CacheFalseAsksTheChainOnEveryResolve()
     {
@@ -1455,6 +1531,15 @@ public class SecretsFeatureTest
             Assert.False(w.Api()[0].HasAuth,
                 "no credential may be sent when auth is suppressed, got " +
                 w.Api()[0].Auth);
+
+            // AND NO PURCHASE. Resolve() runs before WithRefresh's
+            // suppression check, so the refresh token used to go to the
+            // token endpoint in a request body even here. Stopping the
+            // retry does not unsend it, and only the token endpoint can
+            // see this.
+            Assert.True(0 == w.Token().Count,
+                "auth null suppressed the credential but the refresh token was " +
+                "still POSTed to the exchange endpoint");
         }
         finally
         {

package/project/.sdk/tm/elixir/lib/projectname/feature/secrets.ex

@@ -361,10 +361,18 @@ defmodule ProjectName.Feature.Secrets do
 
   # ---- resolution ----------------------------------------------------------
 
-  # One resolution. A settled SUCCESS is kept only when caching is on
+  # One resolution. A settled HIT is kept only when caching is on
   # (`cache: false` means every resolve asks the chain again); a FAILURE is
   # never kept, so a transient vault outage cannot poison the client
   # permanently - the next operation asks the chain again.
+  #
+  # A MISS is not kept either, however caching is set. That rule is
+  # sekreto's, not this feature's: `A miss is never cached: the next read
+  # asks again`, in sekreto's own source. Keeping a settled miss here would
+  # override that from the layer above, and a secret provisioned after
+  # startup - a mounted file, a policy granted a minute late - would never
+  # be picked up for the life of the client. `cache` is about caching a
+  # HIT; it was never a promise to keep saying no.
   def resolve(f) do
     initerr = S.getprop(f, "_initerr")
 
@@ -433,7 +441,8 @@ defmodule ProjectName.Feature.Secrets do
       # - it seats FIRST in the chain as a memory provider, so the chain
       # HITS while one is set and the miss branch is unreachable.)
       S.setprop(f, "_cred", tostr(found))
-      keep(f)
+      # Only a HIT is kept: see resolve/1.
+      if found != nil, do: keep(f)
       :ok
     else
       # Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -451,6 +460,12 @@ defmodule ProjectName.Feature.Secrets do
         keep(f)
         :ok
       else
+        # NO SUPPRESSION CHECK HERE, and that is deliberate: elixir's
+        # transport/5 already returns before resolve/1 when `auth: nil`, so
+        # a suppressed request never reaches this purchase at all. Every
+        # other target guards the purchase itself, because their transports
+        # resolve first. One rule, one place - and here that place is the
+        # transport.
         case buy(f, x) do
           {:ok, _token} ->
             keep(f)

package/project/.sdk/tm/elixir/test/feature/secrets/secrets_test.exs

@@ -631,6 +631,47 @@ defmodule ProjectName.SecretsTest do
       auth_is(Enum.at(api(r), 1), "KEY2")
     end
 
+    # A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+    # feature used to override from the layer above.
+    #
+    # DEFAULT caching here, which is the whole point: `cache: true` is about
+    # holding a HIT (the test below pins that half), and keeping the settled
+    # resolution after a miss meant the chain was never asked again for the
+    # life of the client. A secret provisioned after startup (a mounted
+    # file, a vault policy granted a minute late) was invisible forever.
+    test "active: a cached MISS is re-asked, so a late secret is picked up" do
+      n = :counters.new(1, [])
+      present = :counters.new(1, [])
+
+      late = %{
+        lookup: fn _ ->
+          :counters.add(n, 1, 1)
+          if :counters.get(present, 1) > 0, do: "LATEKEY01", else: nil
+        end,
+        describe: fn -> "late:test" end
+      }
+
+      r = recorder()
+      client = sdk(r, [{"feature", secrets([{"providers", providers([late])}])}])
+
+      ProjectName.direct(client, S.jm(["path", "/one"]))
+      assert Enum.at(api(r), 0).auth == nil,
+             "the chain has nothing yet, so no credential should go out"
+
+      asked = :counters.get(n, 1)
+      assert asked > 0
+
+      # The secret is provisioned while the client is live.
+      :counters.add(present, 1, 1)
+
+      ProjectName.direct(client, S.jm(["path", "/two"]))
+
+      assert :counters.get(n, 1) > asked,
+             "the MISS was cached: a secret that appears later can never be picked up"
+
+      auth_is(Enum.at(api(r), 1), "LATEKEY01")
+    end
+
     test "active: caching on asks the chain once" do
       n = :counters.new(1, [])
       counting = %{

package/project/.sdk/tm/go/feature/secrets_feature.go

@@ -265,10 +265,18 @@ func (f *SecretsFeature) Init(ctx *core.Context, options map[string]any) {
 }
 
 // resolve runs one resolution, shared by every concurrent caller. A
-// settled SUCCESS is kept only when caching is on (`cache: false` means
-// every resolve asks the chain again); a FAILURE is always cleared, so a
+// settled HIT is kept only when caching is on (`cache: false` means every
+// resolve asks the chain again); a FAILURE is always cleared, so a
 // transient vault outage never poisons the client permanently - the next
 // operation asks the chain again.
+//
+// A MISS is cleared too, however caching is set. That rule is sekreto's,
+// not this feature's: `A miss is never cached: the next read asks again`,
+// in sekreto's own source. Retaining a settled miss here would override
+// that from the layer above, and a secret provisioned after startup - a
+// mounted file, a policy granted a minute late - would never be picked up
+// for the life of the client. `cache` is about caching a HIT; it was never
+// a promise to keep saying no.
 func (f *SecretsFeature) resolve() error {
 	if nil != f.initerr {
 		return f.initerr
@@ -284,11 +292,11 @@ func (f *SecretsFeature) resolve() error {
 	f.resolving = call
 	f.mu.Unlock()
 
-	err := f.resolveonce()
+	hit, err := f.resolveonce()
 
 	f.mu.Lock()
 	call.err = err
-	if nil != err || !f.cache {
+	if nil != err || !f.cache || !hit {
 		f.resolving = nil
 	}
 	f.mu.Unlock()
@@ -297,16 +305,19 @@ func (f *SecretsFeature) resolve() error {
 	return err
 }
 
-func (f *SecretsFeature) resolveonce() error {
+// resolveonce resolves once, reporting whether a credential came out of it.
+// That bool is the whole of what resolve() needs to tell a cacheable HIT
+// from a miss it must not retain.
+func (f *SecretsFeature) resolveonce() (bool, error) {
 	if nil == f.sek {
-		return nil
+		return false, nil
 	}
 
 	found, has, err := f.sek.Try(f.secretname)
 	if nil != err {
 		// A provider ERROR fails the op (via the transport gate); only a
 		// MISS falls through.
-		return err
+		return false, err
 	}
 
 	if nil == f.exchange {
@@ -323,7 +334,7 @@ func (f *SecretsFeature) resolveonce() error {
 			f.cred = ""
 		}
 		f.mu.Unlock()
-		return nil
+		return has, nil
 	}
 
 	// Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -350,11 +361,22 @@ func (f *SecretsFeature) resolveonce() error {
 		// A starting access token was supplied. Spend it: if it is stale
 		// the API answers with an expiry status and the transport wrapper
 		// buys another, which is the same path expiry takes anyway.
-		return nil
+		return true, nil
+	}
+
+	// `auth: nil` is the documented way to send NO credential, and a
+	// purchase is a credential-bearing call: the refresh token goes to the
+	// token endpoint in the request body. withrefresh honours suppression
+	// for the RETRY, but it runs after this - by then the refresh token has
+	// already left the process, and no later check can call it back. The
+	// suppression has to be honoured here, before the first purchase, or it
+	// only ever half-held.
+	if nil == f.liveopts["auth"] {
+		return false, nil
 	}
 
 	_, err = f.buy()
-	return err
+	return nil == err, err
 }
 
 // transport wraps whatever transport was current at Init.

package/project/.sdk/tm/go/test/feature/secrets/secrets_feature_test.go

@@ -488,6 +488,89 @@ func TestSecretsChain(t *testing.T) {
 	})
 }
 
+// A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+// feature used to override from the layer above.
+//
+// DEFAULT caching here, which is the whole point: `cache: true` is about
+// holding a HIT, and holding the settled resolution after a miss meant the
+// chain was never asked again for the life of the client. A secret
+// provisioned after startup (a mounted file, a vault policy granted a
+// minute late) was invisible forever, and the only workaround was giving up
+// hit caching entirely.
+func TestSecretsCachedMissIsReasked(t *testing.T) {
+	var mu sync.Mutex
+	calls := 0
+
+	w := makewire()
+	client := secretsClient(w, map[string]any{
+		"feature": map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						calls++
+						// Absent on the first ask, present on the second.
+						if 1 < calls {
+							return "LATEKEY01", true, nil
+						}
+						return "", false, nil
+					},
+				},
+			},
+		}},
+	})
+
+	driveEntityOp(t, client, w)
+	if first := w.api()[0]; first.has && "" != first.auth {
+		t.Fatalf("the first resolve missed, so no credential should go out; got %q", first.auth)
+	}
+
+	driveEntityOp(t, client, w)
+	credentialIs(t, w.api()[len(w.api())-1].auth, "LATEKEY01")
+
+	mu.Lock()
+	defer mu.Unlock()
+	if 1 >= calls {
+		t.Fatal("the chain was asked once and the MISS cached: a secret " +
+			"that appears later can never be picked up")
+	}
+}
+
+// The other half of the same rule: a HIT is still cached by default, so the
+// fix above must not turn every request into a chain walk.
+func TestSecretsCachedHitIsKept(t *testing.T) {
+	var mu sync.Mutex
+	calls := 0
+
+	w := makewire()
+	client := secretsClient(w, map[string]any{
+		"feature": map[string]any{"secrets": map[string]any{
+			"active": true,
+			"providers": []any{
+				&customProvider{
+					lookup: func(name string) (string, bool, error) {
+						mu.Lock()
+						defer mu.Unlock()
+						calls++
+						return "STABLEKEY01", true, nil
+					},
+				},
+			},
+		}},
+	})
+
+	driveEntityOp(t, client, w)
+	driveEntityOp(t, client, w)
+
+	mu.Lock()
+	defer mu.Unlock()
+	if 1 != calls {
+		t.Fatalf("a hit must be cached under the default cache: true, chain asked %d times", calls)
+	}
+}
+
 // customProvider is a sekreto.Provider built in code (the interface is
 // structural: Lookup + Describe).
 type customProvider struct {
@@ -538,6 +621,39 @@ func TestSecretsExchange(t *testing.T) {
 		credentialIs(t, api[1].auth, "ACCESS02")
 	})
 
+	// `auth: nil` SUPPRESSES THE PURCHASE, not just the retry.
+	//
+	// resolve() runs before withrefresh's suppression check, so the refresh
+	// token used to go to the token endpoint in a request body even here.
+	// Stopping the retry does not unsend it - this asserts on the token
+	// endpoint, which is the half the API-call assertions cannot see.
+	t.Run("auth nil buys no token at all", func(t *testing.T) {
+		os.Setenv(envprefix+"REFRESH_TOKEN", "REFRESH01")
+		defer os.Unsetenv(envprefix + "REFRESH_TOKEN")
+
+		w := makewire()
+		w.apistatus = []int{401}
+
+		client := secretsClient(w, map[string]any{
+			"auth": nil,
+			"feature": secretsOpts(map[string]any{
+				"name":     "refresh_token",
+				"exchange": map[string]any{"active": true},
+			}),
+		})
+
+		driveEntityOp(t, client, w)
+
+		if 0 != len(w.token()) {
+			t.Fatalf("auth nil suppressed the credential but the refresh "+
+				"token was still POSTed to the exchange endpoint (%d calls)",
+				len(w.token()))
+		}
+		if call := w.api()[0]; call.has {
+			t.Fatalf("no credential may be sent when auth is suppressed, got %q", call.auth)
+		}
+	})
+
 	t.Run("test mode buys nothing and needs no token endpoint", func(t *testing.T) {
 		os.Setenv(envprefix+"REFRESH_TOKEN", "REFRESH01")
 		defer os.Unsetenv(envprefix + "REFRESH_TOKEN")

package/project/.sdk/tm/java/feature/SecretsFeature.java

@@ -325,10 +325,18 @@ public class SecretsFeature extends BaseFeature {
   }
 
   // resolve runs one resolution, shared by every concurrent caller. A
-  // settled SUCCESS is kept only when caching is on (`cache: false` means
-  // every resolve asks the chain again); a FAILURE is always cleared, so a
+  // settled HIT is kept only when caching is on (`cache: false` means every
+  // resolve asks the chain again); a FAILURE is always cleared, so a
   // transient vault outage never poisons the client permanently - the next
   // operation asks the chain again.
+  //
+  // A MISS is cleared too, however caching is set. That rule is sekreto's,
+  // not this feature's: `A miss is never cached: the next read asks again`,
+  // in sekreto's own source. Keeping a settled miss here would override
+  // that from the layer above, and a secret provisioned after startup - a
+  // mounted file, a policy granted a minute late - would never be picked up
+  // for the life of the client. `cache` is about caching a HIT; it was
+  // never a promise to keep saying no.
   private void resolve() {
     SecretsCall call;
     boolean mine = false;
@@ -353,8 +361,9 @@ public class SecretsFeature extends BaseFeature {
     }
 
     RuntimeException err = null;
+    boolean hit = false;
     try {
-      resolveonce();
+      hit = resolveonce();
     }
     catch (RuntimeException e) {
       err = e;
@@ -362,7 +371,7 @@ public class SecretsFeature extends BaseFeature {
 
     synchronized (this.lock) {
       call.err = err;
-      if (err != null || !this.cache) {
+      if (err != null || !this.cache || !hit) {
         this.resolving = null;
       }
     }
@@ -373,9 +382,12 @@ public class SecretsFeature extends BaseFeature {
     }
   }
 
-  private void resolveonce() {
+  // resolveonce resolves once, reporting whether a credential came out of
+  // it. That boolean is the whole of what resolve() needs to tell a
+  // cacheable HIT from a miss it must not keep.
+  private boolean resolveonce() {
     if (this.sek == null) {
-      return;
+      return false;
     }
 
     // tryget: null is a MISS (the chain had nothing), an exception is an
@@ -392,7 +404,7 @@ public class SecretsFeature extends BaseFeature {
         // unreachable.)
         this.cred = found == null ? "" : found;
       }
-      return;
+      return found != null;
     }
 
     // Exchanging: what the chain resolved is the REFRESH token, kept for
@@ -416,10 +428,23 @@ public class SecretsFeature extends BaseFeature {
       // A starting access token was supplied. Spend it: if it is stale the
       // API answers with an expiry status and the transport wrapper buys
       // another, which is the same path expiry takes anyway.
-      return;
+      return true;
+    }
+
+    // `auth: null` is the documented way to send NO credential, and a
+    // purchase is a credential-bearing call: the refresh token goes to the
+    // token endpoint in the request body. withrefresh honours suppression
+    // for the RETRY, but it runs after this - by then the refresh token has
+    // already left the process, and no later check can call it back. The
+    // suppression has to be honoured here, before the first purchase, or it
+    // only ever half-held.
+    if (this.liveopts.get("auth") == null) {
+      return false;
     }
 
     buy();
+
+    return true;
   }
 
   // withrefresh buys a token and tries the request again when the API says

package/project/.sdk/tm/java/test/feature/secrets/SecretsFeatureTest.java

@@ -760,6 +760,62 @@ public class SecretsFeatureTest {
         + " the wire saw \"" + last.auth + "\"");
   }
 
+  // A MISS IS NOT A CACHEABLE ANSWER - sekreto's own rule, which this
+  // feature used to override from the layer above.
+  //
+  // DEFAULT caching here, which is the whole point: `cache: true` is about
+  // holding a HIT, and keeping the settled resolution after a miss meant
+  // the chain was never asked again for the life of the client. A secret
+  // provisioned after startup (a mounted file, a vault policy granted a
+  // minute late) was invisible forever, and the only workaround was giving
+  // up hit caching entirely.
+  @Test
+  public void active_aCachedMissIsReasked() {
+    final boolean[] present = {false};
+    final int[] calls = {0};
+    Wire wire = new Wire();
+    ProjectNameSDK client = liveClient(wire, secretsOpts(
+        List.of(new TestProvider((name) -> {
+          calls[0]++;
+          return present[0] ? "LATEKEY01" : null;
+        }))));
+
+    client.direct(map("path", "/one"));
+    Call first = wire.api().get(0);
+    assertFalse(first.has && !"".equals(first.auth),
+        "the chain has nothing yet, so no credential should go out");
+
+    int asked = calls[0];
+    assertTrue(0 < asked);
+
+    // The secret is provisioned while the client is live.
+    present[0] = true;
+    client.direct(map("path", "/two"));
+
+    credentialIs(wire.api().get(wire.api().size() - 1).auth, "LATEKEY01");
+    assertTrue(asked < calls[0],
+        "the MISS was cached: a secret that appears later can never be picked up");
+  }
+
+  // The other half of the same rule: a HIT is still cached by default, so
+  // the fix above must not turn every request into a chain walk.
+  @Test
+  public void active_aCachedHitIsKept() {
+    final int[] calls = {0};
+    Wire wire = new Wire();
+    ProjectNameSDK client = liveClient(wire, secretsOpts(
+        List.of(new TestProvider((name) -> {
+          calls[0]++;
+          return "STABLEKEY01";
+        }))));
+
+    client.direct(map("path", "/one"));
+    client.direct(map("path", "/two"));
+
+    assertEquals(1, calls[0],
+        "a hit must be cached under the default cache: true");
+  }
+
   // `auth: null` - the documented way to disable auth outright, which
   // prepareAuth honours before it ever reads the apikey.
   //
@@ -966,6 +1022,14 @@ public class SecretsFeatureTest {
     assertFalse(wire.api().get(0).has,
         "no credential may be sent when auth is suppressed, got \""
         + wire.api().get(0).auth + "\"");
+
+    // AND NO PURCHASE. resolve() runs before withrefresh's suppression
+    // check, so the refresh token used to go to the token endpoint in a
+    // request body even here. Stopping the retry does not unsend it, and
+    // only the token endpoint can see this.
+    assertEquals(0, wire.token().size(),
+        "auth null suppressed the credential but the refresh token was still"
+        + " POSTed to the exchange endpoint");
   }
 
   @Test